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p eriod for" Re p ty A * UNG PATE ° f tMS communiC ^ VP**'* on the cover sheet with the correspondence address - 

A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTHfSY FROM 
THE MAILING DATE OF THIS COMMUNICATION ^rirui ^ mun n^j hKOM 

• aS)tt in no event however, may a rep, yb9tim etv fited 

' ? ilUre !° ,h K e XZ**"™* peri0d tor ^ * ^ ca^e theap^ ^ communication. 

Status 

Responsive to communication(s> filed on 28 January 2005 
2aM This action is FINAL. 2b>D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quayle, 193SC.D. 11, 453 O.G. 213, 
Disposition of Claims 

4) g| CteimfS) 1-13.17-29 and 33-44 to/nro ponHi^ in ih Q * r pi frr|thn 

4a) Of the above claim(s> is/are withdrawn from consideration. 

5) Q Claim(s) is/are allowed. 

6>G3 Ciaim(s) 1-13.17-29 and 33-44 is/are r^toH 

7) Q Claim(s) is/are objected to. 

8) Q Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

1 0>ia The drawing(s) filed on 26 July 2001 is/are: a)(S accepted or b)D objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 

Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
1 1>d The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 
Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or (f) 
a)DAII b)D Some* c)D None of; 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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y No,lca °f Draftsperson's Patent Drawing Review (PTO-948) Paper No(s)/Mail Date. . 

3) &] Information Disclosure Statement(s) (PTO-1449 or PTO/SB/08) 5) □ Notice of Informal Patent Application (PTO-152) 
, Paper No(s)/M all Date 02752005. 6) □ Other . 

U.S. Potent and rradomarfc Office ; ■ . . 

PTOL-326 (Rev. 1-04) 0ffIce ActIon Summary p art uf pgper NoyMai| 20050312 
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Application/Control Number: 09/916,929 Page 2 

Art Unit: 2137 

DETAILED ACTION 

Claims 1-13,17-29, and 33-44 have been considered. 

Information Disclosure Statement 
5 The information disclosure statement filed 2/15/05 fails to comply with the provisions of 

37 CFR 1.97, 1.98 and MPEP § 609 because the references are not listed on a 1449 Form. The 
references have been submitted on an 892 Form. For the examiner to consider an IDS t cited 
patents need to be listed on a 1449 Form. 

It has been placed in the application file, but the information referred to therein has not 
10 been considered as to the merits. Applicant is advised that the date of any re-submission of any 
item of information contained in this information disclosure statement or the submission of any 
missing elements) will be the date of submission for purposes of determining compliance with 
the requirements based on the time of filing the statement, including all certification requirements 
for statements under 37 CFR 197(e). See MPEP § 609 C(1). 

15 

Claim Rejections - 35 USC § 102 

(e) the invention was described in (1) an application for patent, published under section 
122(b), by another filed in the United States before the Invention by the applicant for patent or 
(2) a patent granted on an application for patent by another filed in the United States before 
20 the invention by the applicant for patent, except that an international application filed under 

the treaty defined in section 351(a) shall have the effects for purposes of this subsection of an 
application filed in the United States only if the international application designated the United 
States and was published under Article 21 (2) of such treaty in the English language. 

25 

Claims 1-2,4-7,9-13,17-18,20-23,25-29,33-35,38-40,42, and 44 are rejected under 35 
U.S.C. 102(e) as being anticipated by Grupe, U.S. Patent Application Publication No. 2002/0194212. 

As per claims 1,17, and 33, the applicant describes a method of scanning data comprising the 
30 following limitations which are met by Grope: 

a) executing scanning control logic utilizing a central processing unit ([0008],[0009]>; 

b) identifying a request related to data at the central processing unit ([0008],[0009]); 
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Application/Control Number: 09/916,929 Page 3 

Art Unit: 2137 

c) indicating the data to a scanning co-processor coupled to the central processing unit so that 
the data is scanned by the scanning co-processor under control of the scanning control logic 
([O008],[0009]); 

d) waiting for results from the scanning co-processor ([0008],[0009]); 

5 e) executing additional logic utilizing the central processing unit while waiting for the results 

from the scanning co-processor ([0008],[0009]>; 

f) initiating an event based on the results from the scanning co-processor Q0015],[0017]); 

g) wherein the scanning co-processor is under the control of the central processing unit via 
the execution of the scanning control logic by the central processing unit (10008],[0009]); 

10 h) wherein it is determined whether the data meets a predetermined criteria, where the criteria 

is based on a type of a file associated with the data ([001 2],[0036}); 

i) wherein the data is sent to the scanning co-processor if it is determined that the data meets 
the predetermined criteria ([0012],[0036]); 

j) wherein additional data to be scanned by the scanning co-processor is queued while waiting 
1 5 for the results from the scanning co-processor ([0009]); 

The applicant should note that the central processing unit refers to the CPU of the source 
computer and the scanning co-processor is the scanning computer which the source computer sends 
selected information to for scanning. The scanned data is returned in a log file. The data in the log file 
is processed and a security event, such as deleting a virus [001 7J is performed if the scanning 
20 computer determines that a virus is present. Also, the scanning control logic is maintained in the 
scanning co-processor computer(s). The scanning control logic tells the scanning co-processors to 
search for banned words or phrases, for example [001 1]. The scanning control logic, which controls 
the operation of the scanning co-processor, is executed by the CPU even though the CPU is on the 
source computer because the CPU sends the data to the scanning control logic which implements th 
25 automatic execution of the scan on the scanning computer. 

Regarding parts h> and i), the predetermined criteria can be a type of file. As disclosed by 
Grupe T only executable files can be scanned in one embodiment. Thus, this would increase the speed 
of the scan because only executable files would be transferred to the scan computer. Also, in another 
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AppJication/ControI Number: 09/916,929 
Art Unit: 2137 

embodiment, only emails are scanned in order to confirm, for example, that there is no pornographic 
material present [0036]. In this situation only emails would be sent to the scanning computer. I 

Regarding part j), data is sent to the scanning computer, or scanning co-processor, fn bulk 
[0009]. It is inherent that the data is not all processed at the same exact time but is rather processed I 
5 in a queue on the scanning computer where additional data to be scanned is processed after the I 
results of the first data are processed. I 
The applicant should note that Grupe not only meets all the limitations of the claim but also I 
meets the applicant's overall goal of reducing load on the computer and allowing it to perform other fl 
functions while a scan is taking place because the scan is outsourced to another computer. 

10 

• As per claims 2 and 18, the applicant describes the method of claims 1 and 17, which are met 
by Grupe (see above), with the following limitation which is also met by Grupe: 

Further comprising processing the data utilizing the central processing unit upon the receipt of 
favorable results from the scanning co-processor including a situation where malicious code is not 
15 detected ([001 5D; 

The data received by the CPU is in the form of a log file whfch is processed whether or not the 
results are favorable, or there are no viruses present, or unfavorable, or there is a virus present If 
there is a virus present, a security event is initiated [0017]. 

20 As per claims 4,7,20, and 23, the applicant describes the method of claims 1 ,6,17, and 22. 

which are met by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein the scanning control logic includes hardware ([001 1J); 

The scanning control logic must include memory, which is hardware, to store specific words or 
phrases which it looks for in the scan. 

?5 

As per claims 5 and 21, the applicant describes the method of claims 3 and 20, which are met 
by Grupe (see above), with the following limitation which is also met by Grupe: 

Wherein the scanning control logic is stored on the scanning co-processor [0009]; 



Page 4 
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As the examiner discussed earlier, the scanning control logic resides with the scanning 
computer, or scanning co-processor, and gives the scanning computer instructions (such as specific 
banned words or phrases to look for) during the scan. 

5 As per claims 6 and 22, the applicant describes the method of claims 1 and 17 t which are met 

by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein the scanning control logic includes software [0011]; 

The scanning control logic includes instructions stored in the memory for performing the scan 
and looking for such things as specific banned words and phrases. 

10 

- As per claims 9 and 25, the applicant describes the method of claims 1 and 17, which are met 
by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein the scanning co-processor performs content scanning [0011); 

15 As per claims 10 and 26, the applicant describes the method of claims 1 and 17, which are 

met by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein the scanning co-processor performs virus scanning [001 1]; 

As per claims 11 and 27, the applicant describes the method of claims 1 and 17, which are 
20 met by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein the scanning co-processor includes memory [0016]; 
Since the scanning co-processor is a computer, it includes memory. 

As per claims 12 and 28, the applicant describes the method of claims 1 1 and 27, which are 
25 met by Grupe (see above), with the following limitation which is also met by Grupe: 
Wherein virus signatures are stored in memory [001 1]; 

It is inherent that the virus signatures are stored in order for the scanning co-processor to 
detect that a virus is present. 
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As per claims 13 and 29, the applicant describes the method of cJaims 1 1 and 27; which are 
met by Grupe (see above), with the foflowing limitation which is also met by Grupe: 
Wherein rule sets are stored in memory [001 1]; 
The rule sets are the specific banned words or phrases. 

5 

As per claims 34 and 35, the claims repeat the limitations of claim 1 . which is met by Grupe 
(see above), with the following additional limitations which are also met by Grupe: 

j) initiating a security event upon the receipt of unfavorable results from the scanning co- 
processor including a situation where malicious code is detected ([0015],[0017]); 
10 k > processing the data utilizing the central processing unit upon the receipt of favorable results 

from the scanning co-processor including a situation where malicious code is not detected (f0015]); 

Data is processed as a log file received from the scanning computer. The data is processed 
whether or not the log file says that the scanned data has viruses or doesn't have viruses. If the data 
is processed and a virus is present, a security event such as deleing or disinfecting the virus is initiated 
15 [0017], 

As per claim 38, the applicant discloses the method of claim 1 , which is met by Grupe (see 
above), with the following limitation which is also met by Grupe: 
Wherein the criteria is further based on a user ([0036]); 

20 

As per claim 39, the applicant describes the method of claim 1 1 which is met by Grupe (see 
above), with the following limitation which is also met by Grupe: 

Wherein the criteria is further based on software logic run by a bios ([0036]); 
The criteria is based on logic which tells the computer how to segregate the data. For 
25 example, if the criteria is "email", the software logic finds all the email fifes and sends them to the 
scanning computer for scanning. 

As per claim 40, the applicant describes the method of claim 1 , which is met by Grupe (see 
above), with the following limitation which is also met by Grupe: 
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Wherein the scanning control logic is executed automatically [0009]; 
As described throughout the primary reference, scanning is done on the scanning computer 
once it receives data from the source computer. The source computer sends data to the scanning 
computer, the data is scanned, and the log file is sent back all in an automated process. 

5 

As per claim 42, the applicant describes the method of claim 1, which is met by Grupe (see 
above), with the following limitation which is also met by Grupe: 

Wherein the scanning control logic is executed manually by a user [0028]; 
The primary reference discloses that in some situations the data is not sent automatically but 
10 through "on demand scans" [0028]. "On demand scans" implies that a user is requesting a scan to 
take place. In this situation, the data is sent to the scannina control logic for scanning. 

As per claim 44, the applicant describes the method of claim 1, which is met by Grupe (see 
above), with the following limitation which is also met by Grupe: 
15 Wherein the central processing unit aids the scanning co-processor when a large amount of 

data is to be scanned [0016]; 

As disclosed, the CPU on the source computer can aid the scanning co-processor, or 
scanning computer, by dividing the data to be scanned into fractions and sending the fractions to a 
plurality of scanning computers. 

20 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 1 03(a) which forms the basis for all obviousness 

rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described 
as set forth In section 1 02 of this title, if the differences between the subject matter sought to 
be patented and the prior art are such that the subject matter as a whole would have been 
obvious at the time the invention was made to a person having ordinary skill in the art to which 
said subject matter pertains. Patentability shall not be negatived by the manner in which the 
invention was made. 

Claims 3,8,19,24,36,41 and 43 are rejected under 35 U.S.C. 1 03(a) as being unpatentable 
over Grupe in view of Zuta, International Publication No. WO 98/45778. 
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As per claims 3 and 1 9, the applicant describes the method of claims 1 and 17, which are met 
by Grupe (see above), with the following limitation which is met by Zuta: 

Wherein the central processing unit is coupled to the scanning co-processor via a bus (Zuta: 



Grupe discloses all the limitations of independent claims 1 and 17. However, Grupe does not 
disclose that the CPU is coupled to the scanning co-processor via a bus. 

Zuta discloses a similar anti-virus scanning system in which a supervisor computer (2 of Fig 2) 
monitors the data processed by the CPU of a first computer (1 1 of Fig 2) and intervenes to stop the 
1 0 CPU of the first computer if the supervisor computer thinks a virus might be present. Zuta also 

discloses that the CPU of the first computer and the scanning co-processor of the supervisor computer 
are coupled by a bus (1 7 of Fig 2). 

it would have been obvious to one of ordinary skill in the art at the time the invention was filed 
to incorporate the ideas of Zuta with those of Grupe and add the use of a bus between the CPU of the 
15 first computer and the scanning co-processor of the second computer because a bus is a commonly 
used method of transmitting data between two units. 

As per claims 8 and 24, the applicant describes the method of claims 1 and 17, which are met 
by Grupe (see above), with the following limitation which is met by Zuta: 
20 Wherein the event is initiated under the control of the scanning control logic (Zuta: Page 19, 

2 nd paragraph). 

As per claim 36, the applicant describes the method of claim 3S, which is met by Grupe (see 
above), with the following limitation which is met by Zuta: 
25 Wherein the scanning information is updated via a network periodically (Zuta: Page 12, 2 nd 



As per claim 41 , the applicant describes the method of claim 1 , which is met by Grupe (see 
above), with the following limitation which is met by Zuta: 



5 



Fig 2); 



paragraph); 
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Wherein the scanning control logic is executed automatically when a computer is booted up 
{Page 24, lines 1-3). 

As per claim 43, the applicant describes the method of claim 1, which is met by Grupe (see 
5 above), with the following limitation which is met by Zuta: 

Wherein the scanning control Jogic is executed using software logic run by a bios (Page 24, 
lines 1-3); 

The scanning control logic is implemented on boot-up. This means the scanning control logic 
is implemented using logic run by a bios. 

10 

Claim 37 is rejected under 35 U.S.C. 1 03(a) as being unpatentable over Grupe in view of 
Snavely, (Snavely T Allan; Tullsen, Dean. Symbiotic Jobscheduling for a Simultaneous Multithreading 
Processor. Published in the Proceedings of ASPLOS IX. November 2000). 

As per claim 37, the applicant describes the system of claim 35, which is met by Grupe (see 
above), with the following limitation which is met by Snavely: 

Wherein the additional logic to be executed and the additional data queued to be scanned are 
handled utilizing multi-threading.algorithms (Snavely: Abstract); 

Grupe discloses all the limitations of independent claim 35. However, Grupe fails to mention 
the use of multi-threading algorithms. 

Snavefy discloses that multi-threading algorithms are an effective way to "increase system 
utilization and speedup the execution of jobs" (Snavely: Abstract). It would have been obvious to one 
of ordinary skill in the art at the time the invention was filed to incorporate the ideas of Snavely with 
those of Grupe and use multi-threading algorithms because multi-threading algorithms are an effective 
way to deal with multi-job processing such as with additional logic to be executed or additional data 
queued to be scanned. 

Response to Arguments 
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Applicant's arguments, see Remarks, filed 1/28/05, with respect to the rejection(s)of 
claim(s) 14-16 under Makita and Makita in view of Zuta have been fully considered and are 
persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, 
a new ground(s> of rejection is made in view of Grupe, U.S. Patent Application Publication No. 
5 2002/0194212. 

Applicant's arguments with respect to the rejectfon(s)of claim(s) 37 under Makita in view 
of Zuta. in further view of Slotznick have been fully considered and are persuasive. Therefore, the 
rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection 
10 is made in view of Snavely (Snavely, Allan; Tullsen, Dean. Symbiotic Jobscheduling for a 

Simultaneous Multithreading Processor. Published in the Proceedings of ASPLOS FX. November 
2000). 



Conclusion 

15 Applicant's amendment necessitated the new ground(s) of rejection presented in this 

Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant 
is reminded of the extension of time policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE MONTHS 
from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the 

20 mailing date of this final action and the advisory action is not mailed until after the end of the 

THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the 
date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1 .136(a) will be 
calculated from the mailing date of the advisory action. In no event, however, will the statutory 
period for reply expire later than SIX MONTHS from the date of this final action. 

25 Any inquiry concerning this communication or earlier communications from the examiner 

should be directed to Kevin Schubert whose telephone number is (571) 272-4239. The examiner 
can normally be reached on M-F 8:00-5:00. 
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Application/Control Number: 09/916,929 
Art Unit: 2137 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor. Andrew Caldwell can be reached on (571) 272-3868. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872^9306. 

Information regarding the status of an application may be obtained from the Patent 
5 Application Information Retrieval (PAIR> system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR system, 
see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-21 7-91 97 (toll-free), 

ANDREW CALDWELL 
SOPERVISORY PATENT EXAMINER 
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